CVE-2026-34739 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a stored XSS caused by lack of output encoding in User_Location plugin's testIP.php page, letting remote attackers execute JavaScript via crafted URL, exploit requires admin privileges and victim interaction.

Severity & Score

Impact

An attacker can execute arbitrary JavaScript in an admin's session, potentially leading to session hijacking or full admin control.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-jqrj-chh6-8h78

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner